Hacker News Reader

Comment by knallfrosch | Hacker News Reader

This doesn't explain why Linux doesn't communicate with the secure enclave. Edit: I suspect closed-source hardware drivers, or collaboration with manufacturer is needed - so no fault on the Linux team, but still, an explanation as part of the article would be welcome.

As an aside, Appleland isn't the promised land either.

Apple laptops with a fingerprint reader lack the interface to be unlocked with depth cameras, like any Windows Hello certified camera. This means biometric authentication requires another connected fingerprint reader when the lid is closed.

Apple phones on the other hand have the opposite problem. They have a depth camera and can use your face to unlock, but lack the hardware for fingerprint unlocking. This means you have to lift them up and point them at your face while other phones have built-in fingerprint readers beneath their screens.

View on HN

The cameras - i.e. FaceID - on the iPhone are unlocking the iPhone prematurely (to early).

Why?

Because they unlock the device in advance before you request it by action. Watch the small lock. It unlocks before you swipe up.

Example?

You ask a stranger to take a photo of your group. I think a normal situation. Not an issue with an iPhone SE (1st Gen - 3rd Gen). Just open the camera app from the lock screen and pass it, the photographer just needs to know “red button” and cannot access anything. Same with FaceID? You’re likely in trouble because you probably didn’t covered the front camera while passing the smartphone - it is completely unlocked because FaceID unlocks the device as soon as it recognizes the you. Apple has broken a security promise which we all know and expect. And usually the screen turns on when the phone is picked up (FaceID starts searching) and even if not - by habit many will touch the side-button and launch the camera app from the lock—screen.

Workaround?

Turn FaceID off. Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick). Guess what? Only the first one works for me.

Previously?

Stealing an iPhone handed over for photography was useless. Investigating private data was not possible.

Please note that an unlocked iPhone allows access to all data. And resetting your passwords via E-Mail. I don’t know if the E-Mail is enough to reset the Apple ID.

I’m afraid FaceID was considered too slow by Apple and they decided to make it “feel faster” by scanning for the owner already before the owner swipes up to unlock. It could be secure - only unlock if the user actually requests it by swiping up. The tiny “lock icon” also part of the problem. Within iOS itself a use of FaceID is much more obvious, users note when it is happening.

PS: GNOME and seahorse are nice - when you login in with password it is automatically unlocked. It handles changes of the password also through the shell well, it recognizes the mismatch and ask only once for the old password. Maybe the reason why I didn’t feel the need for “password managers”.

> Or always remember not to look at the device and cover cameras with your fingers (FaceID can be quick)

Picture this:

- Owner hands over phone locked (whether or not in camera)

- Photographer sort of takes its time, acting not too sure about themselves to divert attention while subtly manipulating device so that screen shuts down (wait for screen sleep, or press power button if in camera), claims "oh I made a mistake / screen has shut down" or something to that effect all the while smoothly presenting device as if both demonstrating the fact and asking for help, facing it towards owner so that they can look, yet quickly presses power button which kicks in FaceID which provides haptic feedback as a cue to swiftly turn it around, swipe up, and keep a finger on screen. Photographer runs away, phone is unlocked.

What works: press power button five times, dismiss emergency screen, and only then hand it over. This invalidates authentication and requires pin to unlock (think `sudo -k`).

You don’t need to press it 5 times, just long press vol down and power, until the shutdown screen comes up and dismiss it.

Ah, true; TIL. Both are equally quick to me, although I do personally find 5 press to be slightly easier.

The thing is you can configure the 5 press to :

- emit a loud alarm

- call the emergency number

- send messages to your emergency contacts

And yes it also locks the phone. But that’s not something I would like to use just to get photographed by a stranger ;)

I have never ever heard of a photographer running away with a phone. I think that's more in someone's fantasy than reality. I know it can happen in theory but I wouldn't lose any sleep over it.

Me neither, I merely walked from the scenario that the parent posited.

That said, while waiting for a train at a station, I've had shady people ask me to "place an urgent call" attached with a weird story told in terms that were triggering all sorts of "Nigerian prince scam" alarms, plus when you get like five in a row over an hour of waiting there's certainly something fishy going on here - could just as well be some sort of distraction for an accomplice to steal luggage. No way I'm handing my phone over in such circumstances, however locked.

Yep. The photo thing is my use case and the one where the lock screen fails to work with FaceID. But there a various use cases and this things carry the same data as a laptop.

Losing a Nokia 5110 was bad. Losing an iPhone as “average” user is worse. Losing an iPhone while unlocked is even less unfortunate - you probably need to reset every account, inform contacts and so on.

Imagine the other side. You dropped or lost your phone and nobody will let you make a simple call because this devices are so fragile and important.

Question? Is it possible to initiate a call and then lock the phone? Then a handover should be save?

This solution also works:

* if you’re this paranoid, do not give your phone to a stranger

And buy a compact camera.

To be honest. At the moment a device of any kind is left unattended accessible for others security is already violated. Ability for physical manipulation allows for literally everything - same status as harmful software.

Because I’m not paranoid enough I hope for the best and rely on the login and hardware encryption. Or here on a nickname :)

Anyway. It is a valid use case well handled by Apple and Google in the past. They designed the lock screen for this.

Another option is to use the “Guided Access” accessibility mode which lets you lock the phone into the current app, requiring a password/optionally FaceID to unlock it. Can be activated with a triple click on the power/home button. It’s also great to use with kids to stop them switching apps.

It’s effectively a kiosk mode.

> Stealing an iPhone handed over for photography was useless

Was this ever a thing? I've never heard about a phone handed over for photography being stolen. I'm sure it probably happened to someone somewhere, but I don't think it's a big enough problem to re-engineer how the phone works to prevent it.

Reply on news.ycombinator.com